EP188 Beyond the Buzzwords: Identity's True Role in Cloud and SaaS Security

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here, as ever, are myself, Timothy Peacock, the Senior PM for Risk Analytics and Cloud Threat Detection in Google SecOps, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us and the rest of the Cloud Security Podcast listeners all on our community page. If you like our show, please do hit the rating button in your app of choice. It helps other users discover us. Anton, what are we talking about today?

Well, our other favorite topic, namely identity and access management in the cloud.

Didn't we just do an identity threat detection episode?

I think that's why I said it's a favorite topic, right?

It is a favorite topic. So what do we have to say and who's our guest?

Well, I guess the guest's identity would be a mystery for another 10 seconds or so, maybe 30 seconds. But ultimately one question that puzzles a lot of people in the cloud is user identities, service identities, workload identities. All of this sounds very messy. Even it was messy before cloud.

Yes.

And now it's even messier. So this is, we are going to try to sort this out a little bit.

Do we manage to sort it out, or do we just try to sort it out?

We should ask the listeners, and the answer to this—we can ask this in about thirty minutes.

All right, listeners, let us know whether we helped sort things out or not. And with that, without any further ado, let's introduce today's guest. Listeners, I'm delighted, truly delighted to introduce today's guest. Today we are joined by a dear friend of mine, Dor Flettle, founder and CEO of Sparrow Security. now a senior director of product management at Okta and a former member of the Security Command Center team here at Google. Dor, delighted to have you on the show today.

Same here, Tim. I'm so happy that we can make it work. It was— we always spoke about doing that, so I'm just happy that now is the right time.

Dor, we like to say with a little bit of self-importance, which for you and me is the normal amount, that identity is the new perimeter. And that identity is hugely important in the cloud. Why is that? And could you give us the nuance on that? Because I think we both know that in our bones. Help everybody know that.

In general, identity, like many things in security, is there in the friction point of productivity, user experience, ease of use, and security. Like, the easiest would be to lock everyone down, but we need to somehow generate revenue. And identity is really in the core of those 2. So I'll actually Let me break it simply by technology. We're talking in identity about authentication and authorization. What has changed now in the cloud and SaaS? So authentication, it just became so much easier and so much more vulnerable. In the past, you had a badge to get to an on-prem area. You had the network routers, gateways, a lot of stuff and other security parameters that today, just like Tim's email address and Gmail password is what makes me be accessible to so many things that Tim now owns. So, that's on the authentication side. On the authorization side, the complexity of the cloud and SaaS environments, the fragmentation, and actually ease of adoption in the business of all that is actually what made authorization the wild, wild west. And it's just very hard. It was always hard, just became now much more vulnerable in the cloud world to give the right amount of access, to have the right amount of business risk. So, it's harder to monitor, very complicated, convoluted for security teams and the business owners to actually know what's happening and also understand how to downsize to the right level in a way that AWS, for example, is so different than Salesforce, so different than Google Workspace in the permission model.

Totally.

And that just made the entire attack path so much easier, from penetrating to what are you accessible to once you penetrate.

So, this is like a very logical moment for me to try to order off the menu and add a question to the script. And it's because of my recent obsession with trying to figure out what it means to do IAM right. I think one of the things you mentioned in your response is complexity and how things changed. And so, if somebody wakes you up at 3:00 AM and says, Hey, can you tell me how to do IAM right? What would you answer? Like, I mean, in the cloud, in a modern environment, what does it mean to do IAM right?

Yeah, I think it has to do with the right amount of— there are 2 different types of access here you can talk about. You can talk about the different lifecycle of an identity from provisioning to ongoing usage to decommissioning, which is the first lifecycle. And there is a second lifecycle, which is very much security-oriented, which is pre-breach, And post-breach. That's how we cover so many things in security. And I think the right way to do things in the cloud is, first of all, with a lot of partnership between security and the business owners to make sure we fit the business processes as they need to be, and also covering the end-to-end with holistic coverage of the different steps of an identity and the different phases without assuming that things would just automagically happen themselves.

Yeah.

Does that answer your question, Anton?

Sort of, but I think that— is there any way to increase the level of detail a tiny bit? Because I think that the whole thing makes sense, but how do I put it into practice?

Oh, the hard question.

Yeah, yeah, yeah, the harder question. I think that you answered the hard question really gracefully, but I want to try then the harder question because, hey, you answered the hard question.

For sure. Breaking the fourth wall, I think it really maps to the rest of the discussion. So, just in this time, like, I don't mind answering sort of like the rest of the discussion in a much less structured way.

So, that's fine. Let's hold on and let's do the rest of the discussion. And I think that one thing that comes up when people start thinking about it is a whole bunch of acronyms. And we don't really mean just ITDR, even though it's everybody's favorite. Tim, I think, loves ITDR, right? And of course, there's CAM, there are a few other. Identity-related things. So, some people who look at this whole upheaval in identity space, they assume that they have to buy a whole stack of products. So, help us with the acronym soup. I was told there is also ISPM, which I think Tim surprised me with this one because I didn't really know there is ISPM. I mean, this is one 4-letter acronym.

ISPM, that's how you manage Comcast. No?

Really? I don't know. In any case, I don't know what it is. This is one of those I did not know existed. So, help us with the acronym soup. And are there new products needed? I think Tim's question as written is, why are the new products needed? But I think the question, the real question is, do we really need new products?

For sure. For sure. So, like every growing industry, growing market, we need to help the practitioners understand and the industry as a whole understand what's going on. And identity in particular is very convoluted, very complicated as a very fast-growing Specifically, we see security teams, and they have problems. And now, how do they attend them? The way I simplify things is looking on the pre-breach world and post-breach world, like we're doing in cloud security, for example. And you can talk about the posture management. How do you harden the attack surface? How do you address misconfigurations? How do you address these kinds of things? This is the entire identity security posture management world. Mm-hmm. With full discretionary where we play with. And the ITDR world is a world what happens after the breach. Today, most organizations we speak to are doing self-correlations on the fly, reinventing the wheel in the SIEM. And there is a growing pattern in the last few years to actually make it something more structured and digested by a vendor that actually takes it and does it in the best-of-breed way. because specifically identity is the number one attack vector of the last few years, so justifies a specific investment. To your question about CIEM, cloud entitlement, cloud infrastructure entitlement management, this is a subsector of one of the identity problems, what happens in the cloud infrastructure. For example, how do you fine-grain authorization in GCP? It's a very complicated problem. What we've seen in the last few years is that there is no true KIM vendor as is, but it's converged to other products, some of them mentioned above, because the values are only part of others. Yeah.

Okay. I think that all adds up. You're part of Okta now. Congratulations on the acquisition. Super exciting. Super happy for you. How does Okta think about this ITDR and KIM and ISPM and this acronym soup? How are you trying to make this accessible for people.

For sure, for sure. So, Okta, and I'll also share why we're excited to join Okta.

Yeah.

Okta is an identity platform, one of the best productivity tools out there to actually save people from using excessive passwords, so on and so forth. Over the years where Okta evolved, the market evolved as well. You can just see all the breaches that happened. And more and more over time, security leaders were involved in the Okta decision and then became actually the Okta owners in many cases. And CISOs are just scared about what's going to happen in their identity. Admin sprawl, like, that's a very common use case. CISOs can't sleep at night because of the admin sprawl and the influence to their organization. Okta saw this progress, this evolution and maturity actually of the market, how it transformed. And that really resonated with us and our offering at Sparrow, which was very security-oriented. Like, our persona is the security persona that's in charge of identity. And many times in the last few years, we actually saw those teams either move from IT to security or just evolve in security. And Okta sees themselves as the identity platform. Identity security is part of it. And that's why we're excited to join. I can share that since we joined, customers told me something along the lines of, Your product fills a hole that we had in our security stack with regards to identity. And those are things that we expect Okta to do as the number one identity platform.

Isn't it nice when customers tell you things like that?

Yeah, yeah. I was excited. It's also an amazing, very thoughtful person, which I personally really liked. Yeah.

Yeah. So help me make this a little bit more real. When you talk to these users and they're not telling you all these good things, when they're telling you the bad things, What are the things that they struggle with the most? Like, what makes users bang their heads against the wall?

Wait, wait, Tim. Didn't we decide to limit the podcast show to 6 hours per episode? I think this may violate the 6-hour rule, though, right?

Okay, but you have to answer it briefly.

For sure, for sure. So I'll be brief. The fundamental feeling that we're helping with is the lack of trust and confidence that security teams have with identity. By the way, Spera in Latin is trust. And that's what they're worried by. Specifically, what are the attack vectors that they're experiencing? Admin sprawl is a huge thing. Like, the time to impact on the stock price from an admin account takeover is just very short. A second one is MFA bypasses. We're seeing that on authentication, actually walking the walk of everything is behind MFA, phishing-resistant MFA, is very hard. And customers— we have a lot of success stories of customers that were very surprised by what we found for them. And the last one is offboarding glitches and partially offboarded employees with access. There are a lot of issues with that in the modern workforce, especially in the last few years as organizations had a high turnover. And those are the things that customers realize immediate security value on and are top of mind. Many times, security leaders say, Those are the bare bones of our existence as security practitioners.

So that means that the identity management remains kind of a mess for a lot of organizations. And do you have like a top 3 challenges, something more structured? Like if you think about how people stumble with that, like what are the top 3 ways to stumble, if that makes sense?

Yeah, for sure. One is accumulating debt. Over time, people have more and more permissions that they just accumulate, and it's very hard for security teams to understand how can they realize least privilege without hurting the business. Because the actual way to do it before the data that we provide and other solutions, by the way, is to go and ask people. And when you ask people, that's the way to make enemies. You actually, like, one of the things that customers told us that we made it a data-driven discussion.

Huh.

With context that actually helped them go to the business and address the most critical crown jewels in a very pragmatic way and not alienating. So, just accumulating debt specifically with least privilege is one. Second one that comes up a lot is the process of local accounts. So, the business has to run. A very common example we see in Salesforce is local accounts in Salesforce. We can see by the number of local accounts deviations with our customers, where does their quarter end? Because the salespeople are just adding local accounts. Because if you need to close a deal, the Salesforce admin will do whatever is needed for that. And I don't blame him, by the way. Those systems are complicated, and therefore the local accounts and the MFA bypasses and how you're wearing off the single sign-on solution and MFA that you have. is very common as well.

So, these are great. And also, you mentioned identity management debt, which struck me as something intuitively clear, very scary, but also potentially, dare I say, unfixable. So, what advice do you have for organizations with considerable identity management debt? I'm thinking like Novell IAM, 1980s. Like, this is like what comes to my mind. I was reading some article online about identity, and it did start from Novell. So, imagine that you're— okay, Tim, go. You go first.

So, I love the phrase identity management debt. I've never heard it before, and I think I intuitively know what it means, but when I have that experience, I then get scared. Like, have I overassumed, and are other people going to leap to a different conclusion? So, what does it mean?

In my perspective, it means how many high and critical vulnerabilities do you have in your environment that would make a breach more likely and more meaningful, impactful on your organization and your security team. That's what I see as debt. Where does it stem from? We're seeing a lot of organizations that weren't built, you know, if you are 25 people born in the cloud yesterday, you're probably, and you know, if you follow the 2-pizza rule, like everyone can get fit to 2 pizzas, you're probably fine. But if you're a modern enterprise or something that even started on the on-prem world and then adopted cloud, or just an organization that even started in the cloud and just grew up very fast and had to kind of like retrofit things back, this is the debt that we're finding. A lot of times the on-prem world has its own rules and then the cloud has just completely different rules, as well as the objectives and criticality of identity from a security perspective was just lower. There's a lot of flows about compliance, SOX compliance. A lot of those things actually talk about identity. But from a pure security perspective, you could get away with having a process and not following it as much needed. And that's a lot of the debt that we're seeing. And one of the things that I'm seeing actually from where we're sitting is what approaches the security team take about the debt. Like, some are very pragmatic and saying, hey, listen, for us, maybe at Google, we have 3, 4 assets that if they are breached, then that's critical for us. While, for example, a customer just told me that this week, they're actually based on GCP, they said, if someone hacks our Lucidchart, it's not the end of the world for the stock price. So, we're seeing a very pragmatic approach with some, And we're seeing with others things that are just like much longer-term solutions. And I would just say that it really fits however you need to manage your organization, the risk profile, and how processes are done wherever you work.

So, this triggers my ex-analyst alert for answers that sound like, it depends. So, and I guess that that's true, it depends, but would there be both technical and organizational change, almost culture perspective, Paying off IDM, IAM debt? Like, would there be things to— buttons to push, but also cultures to change, right? It sounds like it's both.

Yeah, yeah. I fully, fully agree on both. I can give you an example. One of the things with our customers that I really remember, one of them went on a webinar with us sort of on this topic, but didn't say it so directly, was that he said, listen, the greatest value you provide is a very clear, path to action. You actually show us a list of the things we— and Spera is not unique, too unique here, but you show us a clear set of things we need to do to get more secure. In how identity has accumulated, that there are a lot of people who came up from more traditional areas in the world, and it's split between security and IT who very often manage the day-to-day of identity, as well as with business owners, because, for example, GCP, or salesforce.com are not managed in IT as is. It actually, what they said is that we help them provide the data to actually make the org change needed and the relevant context to actually do it effectively in the org.

I love that answer. I love how much good advice there is to other security startup founders about making an actionable product in that answer as well. That's really great.

And maybe to add to it, there is one security leader I really love. He told me something pretty, you know, slightly insulting, but I liked it. He said, I don't care about your tool. The tool is only as important as the process that it helps me do.

It sounds very true in SecOps, as, you know, both SIEM and myself have discovered over the years, right? That sometimes it's not the SIEM, it's what you run around it. And I think for identity, it's even more, well, equally important that without process, much else turns to dust.

Yeah. And identity specifically, and you can look into, you said Novell earlier, like things in identity manager approvals, all those things, they are process-heavy in their nature. So, that's whenever you can simplify something, just like the accumulated hours that you're saving are enormous.

So, that's really interesting about debt. But one question I want to think about is, you know, when you were designing your startup, there's a lot of parts of this problem you could have picked at. You could have looked at user identities, service accounts, API keys, secrets management generally. Why did you pick humans versus machine? How did you think about that decision? What's the story there?

Yeah, for sure. The short question is we asked customers.

Oh.

Why do you care?

Why didn't I think of that?

Yeah. Why do you care about— obviously everything is important. Obviously customers, if they had a magic wand, there was one vendor that could solve the entire universe of problems and make them coffee. But with that in mind, where would you like us to start? That's how we positioned it. And they said that by far the human side they felt is more vulnerable, also related to existing compliance issues they have that they anyways have to solve. So that really directed us. Today we already cover non-human, like API keys and stuff like that, but that came slightly later. I would say that In general, talking about debt, the entire space of identity has a lot of debt. Actually handling those identities is one of them because in the past, service accounts, for example, which you mentioned, is something that didn't really have a way to be represented in a good way in identity providers.

Mm.

So many times when we connect to customers, we see something like Office 365, Jira Migration, @google.com or something similar, which actually shows that there is some intermingle between the types of accounts. So anyways, to solve a problem, you need to cover both.

So wait a second. So this is like a depressing thought of the day. Not only there are machine accounts and human accounts, there are also accounts which sort of like mix, of mixed nature. It's like a—

Exactly. Exactly. And even to the simplistic way, think about a help desk. Many times, they have, like, helpdeskadmin1. It's not the same Anton always. There are multiple people across the globe that are stationed with this account. So actually, it's not— doing MFA for those accounts is really complicated. So that's why, on top of the operational problem, you also have a security problem that comes with it.

That's really interesting.

And also, you mentioned monitoring very briefly, and I think it's one of those, I'm nervous if this is one of those throwaway comments like, hey, you should do the monitoring. So is there anything practical as far as how to monitor it? Because sometimes, you know, monitoring definitely wins the easier said than done prize in many cases.

Yeah. So a big thing of what we and other players in the field are doing is actually providing teams the information. Because today, even gathering, like you can't protect what you can't see, even showing them the information with the right context, with the right deviation and right action items is what really helps them with the monitoring task. Because if you ask tomorrow a first layer question, which is, team, how many API keys do you have in your GitHub repository? And the second order question, which is, how many risky API keys do you have in your environment? Both currently don't really have an answer for the most part.

Monitoring is one of those things that a former PM, manager of mine, Shreyas Doshi, would call apple pie product management. It's the kind of thing that sounds great, nobody's ever going to disagree with it, but is it actually that interesting? And I think here it sounds like it might be apple pie, but it's also super necessary and hard to get right. So it's maybe more like a rhubarb pie, which is hard to get right, to stretch his metaphor. Anton, you better ask your question before I talk about pies all day.

Yeah, well, I can use some pie too, so it's—

We all could.

I think we are starting to Pretty much go through most of the planned questions, but I think I want to ask one that's kind of out of the left field. It's not about identities, but it's about your founding experience. So I take it you now live on a tropical island that you purchased from your acquisition money, but can you perhaps tell more people how to— what was your journey from 0 to 1 as a founder? And then how did you sort of— what was the journey to acquisition?

Yeah, for sure. So I can speak as a person who had a pretty extensive side hustle.

He's not arguing with the tropical island point.

No, he's not. He's confirming. I don't know what to say. Tim knows a joke about some things that happened since then. Positive, all positive. But I think where I'm coming from is I'm coming from more like the technical founder's side. And I think maybe the best tip I can give, and I think it's relevant for everyone who's starting even a new product within a company. My personal take is that currently security teams are overworked and they have— everything can explode in their face. Yeah. So, for them to go and actually adopt something new, they don't need it to be marginally better. They need it to be 10x better. And in general, I think one of the things that what I learned that surprised me, at least in the beginning, it wasn't trivial, is that since there are so many things that security teams can address, the list of priorities is a bit ambiguous. And it also ties to ROI for their time. Because actually, if problem number 2 is solvable, then they would go for problem number 2 and not only problem number 1, because tomorrow there might be a breach of a new attack path, and then problem 2 becomes problem 1. So they're all so fluid. I think we can say what's top 10, but within the top 10, actually, the order of priorities, in my perspective, really ties to ROI. And if you have an idea or a solution that's 10x better, then you're on the right track. Because in security, there are so many micro problems that could be solved. We spoke in this chat about like 5 at least.

Yeah.

So yeah.

10x better is stuck in my head as a really good rule. And I've heard it before and it actually makes total sense to me. But you also, I think that that's one of the 2 tests. And the 2 tests is the problem is significant enough. Because you do have people who show up with a 50x improvement for a problem that ultimately people won't pay for to have solved. It is genuinely that much better. But if it's unsolved, it's also kind of fine. So that test needs to apply, right?

Yeah, because they can settle and name your favorite security vendor. They can settle for something else. That's good enough in many, many cases, and they would settle. Depends on just what problems.

I think that is very astute advice. I really like that. And I've loved this whole conversation, but I hate to do the thing I have to do, which is ask our traditional closing questions. First, do you have a tip to help people with their identity security posture? And 2, do you have recommended reading? Because we hate to leave our listeners empty-handed. We think people should read. Reading is good. So what do you got?

Yeah, yeah, for sure. So first tip for identity security, I personally believe in everything I do in life in focus and repeatability. That's what I believe in.

What was that? Could you say that again?

Focus and repeatability.

Good. I got you to repeat it.

Yeah, yeah.

So, and I said the same thing twice. So focus and repeatability, that's one of the things we brought to the market. That's one of the things that you are doing in many other fields. So whenever you feel like you reinvent the wheel and you're, too broad, that's where I take a second look. Again, with the book, and that's something that really resonates with me, I personally got into negotiation books over the last few years. The one I really loved was Secrets of Power Negotiating. I feel like everything I do is negotiate in life in general, even with myself sometimes when I need to run at 5 in the morning. That's something that really helped me have like practical things and also slightly psychological aspects of those items that I really loved.

I love that answer because focus and repeatability is like, that's so core to all of my hobbies. Like when I motorcycle, when I ski, when I go to the range, it's always how can I be focused on this thing? How can I do the same set of steps in the right way every time? That, that's really good advice. And then I also negotiate with myself, but never at 5 AM.

Yeah, with even with ski, I sometimes Think, like, would I have an easy mode in my life? Like, when I ski, I always think I should have done this turn better or placed my weight on that ski slightly more. So again, focus on repeatability. Yeah.

Well, Dor, I can't thank you enough for joining us today. I'm so happy for the outcome with your startup, really impressed with what you've done since being on the team here at Google. And thank you for joining us here on the podcast.

Thank you for having me.

And now we are at time. Thank you very much for listening and, of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter, @Anton_Chuvakin and @_TimPico. Tweet at us, email us, argue with us, and if you like or hate what you hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Security.